how to find the users who have high privilege

[Davor_7]

hehe~ that's too complex for a new kisser...

thank you all the same. :)

[Ian Miller.]

Carl, parhaps you can submit your modified version to the fileserv archive and new/updated freeware is always wanted for the VMS freeware CDs.

I sometimes use
http://vms.process.com/scripts/fileserv/fileserv.com?uaf
for this sort of thing

$ UAF :== $dev:[dir]UAF.EXE
$ UAF/SELECT=(PRIV=CLASS=ALL,DEFPRIV=CLASS=ALL) /DISPLAY=(USERNAME,PRIV,DEFPRIV)

will list all the users with privs in the All class. For information on privilege classes see the Security Manual.

To list all users with OPER
UAF/SELECT=(PRIV=OPER,DEFPRIV=OPER) /DISPLAY=(USERNAME)

[comarow]

There is an excellent third party tool called Point Secure which will provide this information as well as check file protections and all sorts of security related information. We recommend it's use at Colorado Springs for security sensative sites. It runs on the PC and reads your VMS systems.

Bob C

[Davor_7]

Hi Bob
you mean that this tool can be run on Windows and read data from VMS??

[Hein van den Heuvel]

Those tools are good.

If you have (g)awk or perl installed you can do something like:

$mcr authorize list/full
$ gawk "/^User/{u=$2} / Priv/{p=$1} / OPER /{print u,p}" sysuaf.lis

or

$ perl -ne "($a,$b)=split; $u=$b if /^Use/; $p=$a if /\sPriv/; print ""$u $p\n"" if /\sOPER/" sysuaf.lis

Or with a DCL loop workign directly on the source (SYSUAF.DAT) exploiting the following info:

$ pipe libr/ext=$uafdef/out=sys$output sys$library:lib.mlb | searc sys$pipe q_priv
$EQU UAF$Q_PRIV 412
$ pipe libr/ext=$prvdef/out=sys$output sys$library:starlet.mlb | search sys$pipe v_oper
$EQU PRV$V_OPER 18

---- uaf_oper.com ---

$open /read /share uaf 'f$parse("SYSUAF","SYS$SYSTEM:.DAT",,,"SYNTAX_ONLY")
$loop:
$ read/end=done uaf rec
$ if f$cvsi(412*8+18,1,rec) then write sys$output f$extr(0,12,rec)
$ goto loop
$done:
$close uaf


fwiw,
Hein.

[Wim Van den Wyngaert]

This .com does it. Just cut and paste it into test.com and execute it with @.

But there are other ways to get OPER. SETPRV for example.

Wim

[Robert_Boyd]

On post V7 systems you can do this:

$ pipe mcr authorize show */brief | search sys$input: all,system,oper /output=privileged_users.lis

Robert

[Jan van den Ende]

Hein,

care to elaborate on your EQU command?
AFAIK it is not standard DCL....


Proost.

Have one on me.

jpe

[Uwe Zessin]

Jan,

>$EQU UAF$Q_PRIV 412

That is not a DCL command ;-)

It's one line in module ($uafdef) in Macro library (sys$library:lib.mlb) extracted by this command:

$ pipe libr/ext=$uafdef/out=sys$output sys$library:lib.mlb | searc sys$pipe q_priv

[comarow]

Sep 19, 2005 00:11:53 GMT N/A: Question Author

--------------------------------------------------------------------------------
Hi Bob
you mean that this tool can be run on Windows and read data from VMS??



/Exeactly. It is a super monitor and alerts in red problems and can fix many conditions. For example it can fix quorum idssues. It warns if memory tight situations and many problems. Because it has power, it must be on the same lan on the system.

We are set up to do the anaylsis for you for a reasonable fee as well.

It also checks file protections and all sorts of goodies. It has a companion software, System Detective that sets up rules on your VMS system.

send mail to robert.comarow@hp.com for more specifics.

I'm impressed.